JP4309359B2 - Packet communication apparatus and function expansion method thereof - Google Patents

Abstract

A packet communication apparatus comprising a node management processor for controlling the whole apparatus, network interfaces for transmitting and receiving packets to and from external networks, function enhancement modules for performing predetermined processes on the packets, and a switch for transferring the packets within the apparatus. The network interface includes a CPU and a memory, the memory stores a program executed by the CPU, the CPU processes the packet received from the external networks by executing the program, and the function enhancement module stores the program stored in the memory.

Description

  The present invention relates to a packet communication device that transfers a packet on a network, and more particularly to a technique for extending the function of the packet communication device.

  A network that performs packet communication includes a communication device, a terminal, and a link. The communication device relays the packet. The terminal transmits and receives packets at the end of the network. The link connects the terminal and the communication device.

  For example, the terminal transmits the packet to the target terminal. Then, the packet communication device relays the packet to the target terminal. Then, the target terminal receives the packet.

  The packet communication device extracts a destination from the received packet. Next, the next transfer destination corresponding to the extracted destination is searched from the routing table. Then, after executing processing at the time of relaying the packet, the packet is transmitted to the next transfer destination searched.

  Current packet communication devices execute processing at the time of packet relay by hardware. Therefore, when changing the processing at the time of packet relay, it is necessary to replace the entire packet communication apparatus. However, there is a problem in cost in exchanging the entire packet communication device. In addition, quick response is difficult.

  Packet processing apparatuses that solve this problem are known (see, for example, Patent Document 1 and Patent Document 2).

  The packet processing apparatus described in Patent Document 1 includes a packet type and a processing table corresponding to the packet type on a network interface (NIF) of the packet processing apparatus. Then, when a new extension part (function extension module) is added to the packet processing apparatus, the NIF rewrites the table. As a result, the network interface transfers the packet received from the outside to the function expansion module.

  Further, the packet processing device described in Patent Document 2 includes a table similar to the packet processing device described in Patent Document 1 on the NIF. Further, when the NIF receives a packet from the outside, the NIF gives a plurality of fixed length headers to the received packet. Thereby, the network interface can transfer the received packet to a plurality of function expansion modules.

  However, in the conventional packet processing apparatus, the NIF performs only packet transfer processing. In addition, the function expansion module performs processing with higher functionality than the NIF.

  For example, NIF considers the case where most of the packets received from the outside are transferred to the function expansion module. Then, the function expansion module becomes a bottleneck, and there is a problem that the throughput of the entire packet processing device is lowered.

  In order to solve this problem, a technique for preinstalling a program for reducing the processing of the function expansion module in all NIFs is known.

In addition, information necessary for the function expansion module to process a packet may be transferred to the function expansion module after being added by the NIF. In particular, when such information differs depending on the type of function expansion module, there is a problem that the administrator must update the NIF settings and software each time a function expansion module is added.
JP 2003-258842 A JP 2004-289223 A

  A packet processing apparatus that pre-installs a program for reducing processing of the function expansion module in all NIFs is limited in the types of function expansion modules that can be applied. In addition, the packet processing apparatus cannot support a function expansion module that executes a newly required process. In addition, since the NIF of the packet processing apparatus also stores unnecessary programs, the efficiency of memory resources is poor.

  Therefore, an object of the present invention is to provide a packet communication apparatus that solves these problems.

  The present invention includes a node management processor that controls a device, a network interface that transmits and receives packets to and from an external network, a function expansion module that performs predetermined processing on the packets, and a switch that transfers the packets within the device The network interface includes a CPU and a memory, and the memory stores a program executed by the CPU, and the CPU executes the program to execute the external network. The function expansion module stores a program stored in the memory.

  The packet communication apparatus of the present invention can add a new function expansion module by updating a program that performs packet processing in the network interface.

  Also, the management load on the packet transfer apparatus can be reduced by installing a program having functions other than packet processing in the network interface.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  1-1 is a block diagram of the packet communication apparatus 101 according to the embodiment of this invention.

  The packet communication apparatus 101 includes a node management processor 102, an operator control terminal 103, an intra-node memory 104, a network interface (NIF) 105, a module I / F 106, a control I / F 107, a function expansion module 108, and an internal switch 109. .

  Note that any number of the network interface 105, the module I / F 106, and the function expansion module 108 may be provided.

  The node management processor 102 manages the entire packet communication apparatus 101.

  The operator control terminal 103 is a computer including a display unit (for example, a liquid crystal display) and an input unit (for example, a keyboard). An instruction to the packet communication apparatus 101 is input from the operator to the operator control terminal 103. In addition, the operator control terminal 103 transmits the input instruction to the node management processor 102.

  The control I / F 107 is an interface that connects the node management processor 102 and the operator control terminal 103. The control I / F 107 and the node management processor 102 may be directly connected or may be connected via the internal switch 109.

  The intra-node memory 104 is connected to the node management processor 102 and stores information used by the node management processor 102. The intra-node memory 104 and the node management processor 102 may be directly connected or may be connected via an internal switch 109.

  The network interface 105 transmits and receives packets to and from the external network 110. The network interface 105 can install a program without stopping the function of transmitting and receiving packets. Similarly, the network interface 105 can delete the installed program without stopping the function of transmitting and receiving packets. The network interface 105 performs a predetermined process on the received packet by executing the installed program. The predetermined processing is, for example, encapsulation processing, encryption processing, and / or decryption processing.

  The external network 110 is a user network, an ISP (Internet Service Provider) network, an access network, or the like. The user network is a network to which a user is directly connected. The ISP network is a network to which an Internet server is directly connected. The Internet server is a computer that provides Internet services to users. The access network is a network that connects the user network and the ISP network.

  The module I / F 106 is an interface that connects the internal switch 109 and the function expansion module 108.

  The module I / F 106 and the control I / F 107 may be interfaces having functions equivalent to those of the NIF 105.

  The function expansion module 108 can be attached to and detached from the module I / F 106. The function expansion module 108 provides a function to the packet communication apparatus 101 when mounted in the module I / F 106.

  The internal switch 109 is connected to a part in the apparatus including the node management processor 102, the network interface 105, the module I / F 106, and the like. The internal switch 109 stores a forwarding table. The forwarding table indicates the correspondence between the packet header information and the packet transfer destination.

  Specifically, the internal switch 109 receives a packet from a part in the connected device. Next, the internal switch 109 determines the transfer destination of the received packet with reference to the forwarding table. Then, the internal switch 109 transfers the packet to a site in the determined transfer destination device.

  FIG. 1-2 is a configuration diagram of a packet inside the packet communication apparatus 101 according to the embodiment of this invention.

  A packet (internal packet) 113 inside the packet communication apparatus 101 includes an internal header 111 and a payload 112.

  The internal header 111 stores information such as an address (internal address) that is valid only inside the packet communication apparatus 101. The payload 112 stores the contents of the packet.

  FIG. 2 is a block diagram of a network to which the packet communication apparatus 101 according to the embodiment of this invention is applied.

  This explanatory diagram shows a typical configuration of a network in which the user terminal 201 is connected to the Internet 202. This network includes the Internet 202, an access network 203 and an ISP network 205.

  The user terminal 201 is a computer that is connected to the Internet 202 via the ISP network 205.

  The Internet 202 is a network constructed by a large number of servers.

  The ISP network 205 includes an Internet server 207 and a node 204. The Internet server 207 provides Internet service to the user terminal 201. Node 204 forwards the packet over the network.

  The access network 203 is a network that connects the user terminal 201 and the ISP network 205. The access network 203 includes a node 204.

  Furthermore, the packet communication apparatus 101 of the present embodiment can be applied to the node 204 included in the ISP network 205 and / or the node 204 included in the access network 203. In this case, the packet communication apparatus 101 connects the Internet server 207 and the user terminal 201 and transfers the packet. The packet communication apparatus 101 performs a predetermined process on the packet to be transferred. The predetermined processing is, for example, packet filtering processing, authentication processing, and / or encryption processing.

  FIG. 3A is a block diagram of the network interface 105 according to the embodiment of this invention.

  The NIF 105 includes a NIF management processor 301, a NIF internal memory 302, a packet processing processor 303, an internal I / F 305, an external I / F 306, and a NIF internal switch 307.

  Although n external I / Fs 306 are illustrated, any number is possible.

  The NIF internal switch 307 is connected to the NIF management processor 301, the NIF internal memory 302, the packet processing processor 303, the internal I / F 305, and the external I / F 306.

  The NIF management processor 301 manages the entire NIF 105.

  The in-NIF memory 302 stores information used by the NIF management processor 301. Further, the intra-NIF memory 302 temporarily stores packets received from the internal I / F 305 or the external I / F 306.

  Further, the intra-NIF memory 302 stores a forwarding table described later with reference to FIG. The forwarding table indicates the correspondence between the packet header information and the packet transfer destination. Further, the forwarding table stored in the in-NIF memory 302 includes contents for processing the packet by the packet processing processor 303.

  The packet processing processor 303 includes a program memory 304. The program memory 304 stores a program for processing a packet. The program stored in the program memory 304 performs, for example, an encapsulation process, an encryption process, and / or a decryption process.

  The programs stored in the program memory 304 are preferably created according to the same standard. In this way, the program memory 304 can be used efficiently.

  The packet processor 303 performs a predetermined process on the packet by executing a program stored in the program memory 304.

  Note that the contents of processing executed by the packet processing processor 303 can be changed by changing the program stored in the program memory 304.

  The program memory 304 may store a forwarding table (FIG. 4-2) instead of the intra-NIF memory 302.

  The internal I / F 305 is an interface that connects the internal switch 109 and the NIF internal switch 307.

  The external I / F 306 is an interface that connects the external network 110 and the NIF internal switch 307.

  Here, processing of the network interface 105 that has received a packet from the external I / F 306 will be described.

  The external I / F 306 receives a packet from the connected external network 110. Then, the external I / F 306 transmits the received packet to the NIF internal memory 302 via the NIF internal switch 305.

  Next, the in-NIF memory 302 stores the received packet.

  Next, the packet processing processor 303 analyzes the contents of the packet stored in the NIF memory 302. The packet processing processor 303 performs processing corresponding to the analyzed content on the packet.

  For example, the packet processing processor 303 analyzes a packet stored in the intra-NIF memory 302 as an IP packet. Then, the packet processing processor 303 refers to the forwarding table (FIG. 4B) stored in the NIF internal memory 302 and determines the NIF 105 that transfers the packet to the outside.

  Next, the packet processing processor 303 adds the determined internal address of the NIF 105 to the packet. Then, the packet processing processor 303 transmits the packet to which the internal address is added to the internal switch 109 via the NIF internal switch 307 and the internal I / F 305.

  3-2 is a block diagram of the function expansion module 108 according to the embodiment of this invention.

  The function expansion module 108 includes an in-module processor 308, an in-module memory 309, and an in-module I / F 310.

  The module internal I / F 310 is an interface that transmits and receives packets to and from the internal switch 109.

  The intra-module memory 309 stores information (including programs) used by the intra-module processor 308. Further, the in-module memory 309 stores a program installed in the network interface 105.

  The intra-module processor 308 processes a packet received from the internal module I / F 310 by executing a program stored in the intra-module memory 309. The in-module processor 308 manages the entire function expansion module 108.

  FIG. 4A is an explanatory diagram of internal addresses of parts constituting the packet communication apparatus 101 according to the embodiment of this invention.

  In the present embodiment, an internal address “1, 2,...” Is assigned to each part in the apparatus.

Specifically, the internal address of the node management processor 102 is “1”. The internal address of the internal switch is “2”. The internal address of NIF (1) 105 is “3”, and the internal address of NIF (2) 105 is “4”. The internal address of the module I / F (1) 106 is “7”, and the internal address of the module I / F (2) 106 is “8”. Also, the internal address of the function expansion module (1) 108 is “11”, the internal address of the function expansion module (2) 108 is “12”, and FIG. 1) It is a block diagram of the forwarding table 401 of 105. FIG.

  The forwarding table 401 includes header information 402 and processing contents 403.

  The header information 402 includes a destination internal address 404, a payload type 405, and an IP address / prefix length 406.

  The destination internal address 404 is an internal address of a part in the apparatus to which the packet is next transferred. The payload type 405 is header information in Ethernet (registered trademark, hereinafter the same), and is the type of information stored in the payload. The IP address / prefix length 406 stores the IP address of the transmission destination of the packet. Further, the IP address / prefix length 406 stores the length (prefix length) of the network address portion of the IP address.

  The processing content 403 is content that the NIF (1) 105 processes a packet corresponding to the record. The processing contents store the transfer destination of the packet and the name of the program that processes the packet.

  The NIF (1) 105 receives a packet from the internal I / F 305 or the external I / F 306. Then, the NIF (1) 105 extracts a header from the received packet. Next, the network interface (1) 105 selects a record in which the extracted header matches the header information 402 of the forwarding table 401 from the forwarding table 401. Next, the NIF (1) 105 extracts the processing content 403 from the selected record.

  Next, the NIF (1) 105 processes the packet by executing a program having the program name stored in the extracted processing content 403. Then, the NIF (1) 105 transmits the processed packet to the transfer destination stored in the extracted processing content 403.

  FIG. 5A is a configuration diagram of the node management processor processing code management table 700 according to the embodiment of this invention.

  The node management processor processing code management table 700 is stored in the intra-node memory 104, the intra-NIF memory 302 of the network interface 105, and the intra-module memory 309 of the function expansion module 108.

  The node management processor processing code management table 700 includes a node management processor processing code 701 and processing contents 702.

  The node management processor processing code 701 is a unique identifier of the processing content 702. The processing content 702 is a processing content requested to the node management processor 102.

  FIG. 5B is a configuration diagram of the program acquisition code management table 710 according to the embodiment of this invention.

  The program acquisition code management table 710 is stored in the intra-node memory 104, the intra-NIF memory 302 of the NIF 105, and the intra-module memory 309 of the function expansion module 108.

  The program acquisition code management table 710 includes a program acquisition code 711 and an acquisition method 712.

  The program acquisition code 711 is a unique identifier for the acquisition method 712.

  The acquisition method 712 is a method by which the node management processor 102 acquires a program.

  FIG. 5C is a configuration diagram of the NIF designation code management table 720 according to the embodiment of this invention.

  The NIF designation code management table 720 is stored in the intra-node memory 104 and the intra-module memory 309 of the function expansion module 108.

  The NIF designation code management table 720 includes a NIF designation code 721 and a transmission destination 722.

  The NIF designation code 721 is a unique identifier of the transmission destination 722. A transmission destination 722 indicates the NIF 105 that is a transmission destination of the program.

  FIG. 5-4 is a configuration diagram of the packet designation code management table 730 according to the embodiment of this invention.

  The packet designation code management table 730 is stored in the intra-node memory 104, the intra-NIF memory 302 of the NIF 105, and the intra-module memory 309 of the function expansion module 108.

  The packet designation code management table 730 includes a packet designation code 731 and a packet type 732.

  The packet designation code 731 is a unique identifier of the packet type 732. The packet type 732 is a type determined from the packet header or the like, and is, for example, a payload type or an IP address.

  FIG. 6A is a configuration diagram of the NIF-program management table 800 according to the embodiment of this invention.

  The NIF-program management table 800 is stored in the intra-node memory 104 and the intra-NIF memory 302 of the NIF 105.

  The NIF-program management table 800 shows the correspondence between the NIF 105 and programs.

  The NIF number 802 is a unique identifier of the NIF 105. The program name 801 is a unique identifier of the program.

  If a program with the program name 801 is installed in the NIF 105 with the NIF number 802, a circle is stored in the corresponding box of the NIF-program management table 800.

  Further, the NIF-program management table 800 includes a reference counter (ref) 803 and a memory remaining rate (rem) 804.

  The reference counter 803 is the number of function expansion modules 108 using the program.

  The memory remaining rate 804 is a ratio of an unused area of the program memory 304 of the NIF 105.

  The NIF-program management table 800 may include information such as the correspondence between the function expansion module 108 and the program and the correspondence between the NIF 105 and the function expansion module 108.

  FIG. 6B is a configuration diagram of the NIF processing code management table 740 according to the embodiment of this invention.

  The NIF processing code management table 740 is stored in the intra-node memory 104 and the intra-NIF memory 302 of the NIF 105.

  The NIF processing code management table 740 includes an NIF processing code 741 and an NIF processing content 742.

  The NIF processing code 741 is a unique identifier of the NIF processing content 742. The NIF processing content 742 is the content of processing performed by the NIF 105.

  FIG. 6C is a configuration diagram of the update code management table 750 according to the embodiment of this invention.

  The update code management table 750 is stored in the intra-node memory 104 and the intra-NIF memory 302 of the NIF 105.

  The update code management table 750 includes an update code 751 and NIF update contents 752.

  The update code 751 is a unique identifier of the NIF update content 752. The NIF update contents 752 are contents that the NIF 105 updates the forwarding table 401.

  FIG. 7A is a configuration diagram of the program designation code management table 760 according to the embodiment of the present invention.

  The program designation code management table 760 is stored in the intra-node memory 104 and the intra-NIF memory 302 of the NIF 105.

  The program designation code management table 760 includes a program designation code 761 and a transmission program 762.

  The program designation code 761 is a unique identifier of the transmission program 762. A transmission program 762 indicates a program installed in the network interface 105.

  FIG. 7B is a configuration diagram of the module processing code management table 770 according to the embodiment of this invention.

  The module processing code management table 770 is stored in the intra-node memory 104 and the intra-module memory 309 of the function expansion module 108.

  The module processing code management table 770 includes a module processing code 771 and module processing content 772.

  The module processing code 771 is a unique identifier of the module processing content 772. Module processing content 772 is the content of processing requested to the function expansion module 108.

  FIG. 8 is a flowchart of the function expansion module addition process of the packet communication apparatus 101 according to the embodiment of this invention.

  The function expansion module 108 is connected to the module I / F 106. Then, the packet communication apparatus 101 starts an addition process for the function expansion module 108 (501).

  Specifically, the function expansion module 108 detects that its own module internal I / F 310 and the module I / F 106 of the packet communication apparatus 101 are connected. When detecting the connection, the function expansion module 108 transmits an installation request internal packet to the node management processor 102 (502).

  The installation request internal packet is a packet for requesting the NIF 105 to install the program, and includes an internal header 111 and a payload 112.

  FIG. 9A is a configuration diagram of the internal header 111 according to the embodiment of this invention.

  The internal header 111 includes a destination address 601 and a transmission source address 602.

  The destination address 601 is an internal address of a part in the apparatus that receives the packet. The transmission source address 602 is an internal address of a part in the device that transmits the packet.

  In the installation request internal packet, the destination address 601 is the internal address of the node management processor 102. A source address 602 is an internal address of the function expansion module 108.

  In the packet communication apparatus 101 in which the function expansion module 108 cannot know the internal address of the node management processor 102, it is necessary to set a multicast address in advance. The installation request internal packet uses the destination address 601 as the multicast address. A packet having a multicast address as a destination address is transmitted to all parts in the apparatus.

  However, when a part in the apparatus other than the node management processor 102 receives an internal packet whose destination address is a multicast address, the part is discarded. Alternatively, when the internal switch 109 receives an internal packet whose destination address 601 is a multicast address, the internal switch 109 transfers the packet only to the node management processor 102. As a result, only the node management processor 102 receives the installation request internal packet.

  9-2 is a configuration diagram of the payload 112 of the install request internal packet including the program according to the embodiment of this invention.

  The payload 112 of the install request internal packet in this explanatory diagram includes a program 607. Further, it includes a node management processor processing code 701, a program acquisition code 711, an NIF designation code 721 and a packet designation code 731.

  The function expansion module 108 creates the payload 112 of the installation request internal packet as follows.

  First, the function expansion module 108 selects, from the node management processor processing code management table 700, a record whose processing content requested to the node management processor 102 matches the processing content 702 of the node management processor processing code management table 700. To do. Next, the node management processor processing code 701 is extracted from the selected record. The extracted node management processor processing code 701 is stored in the payload 112 of the packet.

  The installation request internal packet requests the node management processor 102 to add the function expansion module 108. Therefore, the function expansion module 108 stores the node management processor processing code 701 as “0” in the payload 112 of the packet.

  Next, the function expansion module 108 selects, from the program acquisition code management table 710, a record whose method by which the node management processor 102 acquires the program matches the acquisition method 712 of the program acquisition code management table 710. Next, the program acquisition code 711 is extracted from the selected record. Then, the extracted program acquisition code 711 is stored in the payload 112 of the packet.

  The payload in this explanatory diagram includes a program 607. Therefore, the function expansion module 108 stores the program acquisition code 711 as “0” in the payload 112 of the packet.

  Next, the function expansion module 108 selects, from the NIF designation code management table 720, a record in which the NIF 105 in which the program is installed matches the transmission destination 722 of the NIF designation code management table 720. Next, the NIF designation code 721 is extracted from the selected record. The extracted NIF designation code 721 is stored in the payload 112 of the packet.

  The installation request packet in this explanatory diagram is a case where the operator specifies the NIF for installing the program. Therefore, the function expansion module 108 stores the NIF designation code 721 as “1” in the payload 112 of the packet.

  Next, the function expansion module 108 stores a program 607 to be installed in the network interface 105 in the payload of the packet. The program 607 includes a program name 608.

  The program name 608 is a unique identifier of the program. Note that the program name 608 preferably indicates the version and characteristics of the program. Thus, the operator control terminal 103 displays the program name 608, so that the operator can understand the type of program.

  Next, the function expansion module 108 selects, from the packet designation code management table 730, a record in which the packet type for which the network interface 105 executes the program 607 matches the packet type 732 in the packet designation code management table 730. Next, the packet designation code 731 is extracted from the selected record. Then, the extracted packet designation code 731 is stored in the packet payload.

  The installation request packet may include a plurality of programs 607. In this case, the installation request packet includes a packet designation code 731 corresponding to each program 607.

  For example, the packet designation code 731 corresponding to the program 607 whose program name 608 is “4.0.1” is “1”.

  FIG. 9-3 is a configuration diagram of the payload 112 of the installation request internal packet including the location information of the program according to the embodiment of this invention.

  The payload 112 of the install request internal packet in this explanatory diagram includes program location information 609. The other configuration is the same as the payload (FIG. 9-2) of the installation request internal packet including the program. The same number is attached | subjected to the same structure and description is abbreviate | omitted.

  The program location information 609 is information relating to the location of a program to be installed in the network interface 105. The program location information 609 is, for example, the URL of a server storing the program or the IP address of a node storing the program.

  Note that the payload in this explanatory diagram includes program location information 609 instead of the program 607. Therefore, the function expansion module 108 stores the program acquisition code 711 as “1” in the payload 112 of the packet.

  Returning now to FIG. The node management processor 102 receives the installation request internal packet from the function expansion module 108.

  Next, the node management processor 102 extracts the node management processor processing code from the received installation request internal packet. Next, the node management processor 102 manages the node management processor processing code management for a record in which the extracted node management processor processing code matches the node management processor processing code 701 in the node management processor processing code management table 700. Select from table 700. Next, the node management processor 102 extracts the processing content 702 from the selected record (503).

  Then, the node management processor 102 performs processing corresponding to the extracted processing content 702. Here, since the node management processor processing code 701 is “0”, the node management processor 102 performs the function expansion module addition processing.

  Specifically, the node management processor 102 extracts the destination address 601 from the internal header 111 of the received installation request internal packet. Next, the node management processor 102 stores the extracted destination address 601 in the intra-node memory 104 as the internal address of the newly added function expansion module 108 (504).

  However, if the internal address is not an address that is fixedly assigned to each part (for example, Ethernet MAC address), the node management processor 102 does not store the extracted destination address 601 as the internal address. In this case, the node management processor 102 assigns an available internal address to the function expansion module 108. Next, the node management processor 102 stores the assigned internal address in the intra-node memory 104. Then, the node management processor 102 sets the assigned internal address in the internal switch 109 as the internal address of the function expansion module 108.

  Next, the node management processor 102 extracts a program acquisition code from the received installation request internal packet (505). Next, a record in which the extracted program acquisition code matches the program acquisition code 711 of the program acquisition code management table 710 is selected from the program acquisition management table 710. Next, the node management processor 102 extracts the acquisition method 712 from the selected record. Then, the node management processor 102 acquires a program by processing corresponding to the extracted acquisition method 712.

  Specifically, when the extracted program acquisition code 711 is “0”, the node management processor 102 determines that the program 607 is stored in the payload 112 of the install request internal packet. Therefore, the node management processor 102 acquires the program 607 and the program name 608 from the payload 112 of the installation request internal packet (506-1).

  If the extracted program acquisition code 711 is “1”, the node management processor 102 determines that the program location information 609 is stored in the payload 112 of the installation request internal packet. Therefore, the node management processor 102 acquires the program and the program name based on the program location information 609 stored in the payload 112 (506-2).

  If the extracted program acquisition code 711 is “2”, the node management processor 102 determines that the program name is stored in the payload 112 of the installation request internal packet. Therefore, the node management processor 102 searches the intra-node memory 104 for information on the program name stored in the payload 112.

  When the program having the program name is stored in the intra-node memory 104, the node management processor 102 acquires the program from the intra-node memory 104 (506-3).

  On the other hand, when the location information of the program with the program name is stored in the intra-node memory 104, the node management processor 102 acquires the location information from the intra-node memory 104. Then, the node management processor 102 acquires a program based on the acquired location information (506-3).

  Next, the node management processor 102 extracts the packet designation code 731 from the payload 112 of the received installation request internal packet. Then, the node management processor 102 stores the acquired program, the acquired program name, and the extracted packet designation code 731 in the intra-node memory 104 (507).

  Next, the node management processor 102 extracts the NIF designation code from the payload 112 of the received installation request internal packet (508).

  Next, the node management processor 102 selects, from the NIF specification code management table 720, a record in which the extracted NIF specification code matches the NIF specification code 721 of the NIF specification code management table 720. Next, the node management processor 102 extracts the transmission destination 722 from the selected record. Then, the node management processor 102 transmits the program to the extracted network interface 105 of the transmission destination 722.

  Specifically, when the extracted NIF designation code 721 is “0”, the node management processor 102 determines all NIFs 105 as program transmission destinations. Therefore, the process proceeds to step 511 as it is.

  On the other hand, when the extracted NIF designation code 721 is “1”, the node management processor 102 determines that the NIF 105 for installing the program is designated by the operator. Therefore, the node management processor 102 transmits an NIF designation request to the operator control terminal 103 (509). The NIF designation request includes the program name stored in the intra-node memory 104 in step 507.

  Then, the operator control terminal 103 displays information corresponding to the received NIF designation request on the display unit.

  FIG. 10A is an explanatory diagram of a display screen of the operator control terminal 103 that has received the NIF designation request according to the embodiment of this invention.

  The operator control terminal 103 displays the NIF-program management table 800 (FIG. 6-1), the message 806, and the like.

  Specifically, the operator control terminal 103 extracts a program name from the received NIF designation request. Next, the operator control terminal 103 displays a message 806 requesting designation of the network interface 105 for installing the extracted program name program.

  Further, the operator control terminal 103 acquires the NIF-program management table 800 from the intra-node memory 104. Then, the operator control terminal displays the acquired NIF-program management table 800.

  The operator can visually grasp the program installation status of the NIF 105 by checking the display screen of the operator control terminal 103.

  Returning now to FIG.

  The operator designates the NIF 105 for installing the program on the operator control terminal 103 (510).

  The operator control terminal 103 notifies the node management processor 102 of the NIF 105 designated by the operator. Then, the node management processor 102 determines the notified NIF 105 as a program transmission destination.

  Next, the node management processor 102 refers to the NIF-program management table 800 to determine whether or not the program is already installed in the NIF 105 determined as the transmission destination (511).

  Specifically, the node management processor 102 matches the name of the program to be installed with the program name 801 of the NIF-program management table 800, and further determines the NIF number of the NIF 105 determined as the transmission destination and the NIF-program management table 800. The block with the same NIF number 804 is extracted.

  Then, the node management processor 102 determines that it is already installed if a circle is stored in the extracted block. On the other hand, if the extracted block is blank, it is determined that it is not installed.

  When determining that the program is not installed, the node management processor 102 transmits a program installation request packet to the network interface 105 determined as the transmission destination (512).

  FIG. 10-2 is a configuration diagram of a program installation request packet according to the embodiment of the present invention.

  The program installation request packet includes an internal header 111 and a payload 112.

  The internal header 111 includes a destination address 601 and a transmission source address 602.

  The destination address 601 is an internal address of a part in the apparatus that receives the packet. The transmission source address 602 is an internal address of a part in the device that transmits the packet.

  In the program installation request packet, the destination address 601 is the internal address of the NIF 105 that is the packet transmission destination. A source address 602 is an internal address of the node management processor 102.

  The payload 112 includes an NIF processing code 741, an internal address 902 of the function expansion module, a packet designation code 731, a program 903, and a program name 904.

  Note that the payload 112 may include a plurality of programs 903. In this case, the payload 112 includes a packet designation code 731 and a program name 904 corresponding to each program 903.

  The node management processor 102 creates the payload 112 of the program installation request packet as follows.

  First, the node management processor 102 selects from the NIF processing code management table 740 a record whose processing content requested to the NIF 105 matches the NIF processing content 742 of the NIF processing code management table 740. Next, the NIF processing code 741 is extracted from the selected record. Then, the extracted NIF processing code 741 is stored in the payload 112 of the packet.

  The program installation request packet requests the network interface 105 to install the program 903 stored in the payload. Therefore, the node management processor 102 stores the NIF processing code 714 as “0” in the payload 112 of the packet.

  Next, the node management processor 102 extracts the internal address stored in the intra-node memory 104 in step 504. Next, the extracted internal address is stored in the payload 112 of the packet as the internal address 902 of the function expansion module added to the packet communication apparatus 101.

  Next, the node management processor 102 extracts the packet designation code 731, the program, and the program name stored in the intra-node memory 104 in Step 507. Then, the extracted packet designation code 731, program, and program name are stored in the packet payload 112.

  Returning now to FIG.

  On the other hand, if the node management processor 102 determines in step 511 that the program has already been installed, the node management processor 102 does not need to transmit the program to the network interface 105. Therefore, the node management processor 102 transmits a forwarding table update request packet to the NIF 105 determined as the transmission destination (513).

  FIG. 10C is a configuration diagram of a forwarding table update request packet according to the embodiment of the present invention.

  The forwarding table update request packet includes an internal header 111 and a payload 112.

  The internal header 111 includes a destination address 601 and a transmission source address 602.

  The destination address 601 is an internal address of a part in the apparatus that receives the packet. The transmission source address 602 is an internal address of a part in the device that transmits the packet.

  In the forwarding table update request packet, the destination address 601 is the internal address of the packet transmission destination NIF 105. A source address 602 is an internal address of the node management processor 102.

  The payload 112 includes an NIF processing code 741, an update code 751, an internal address 902, a packet designation code 731 and a program name 904.

  Note that the payload 112 may include a plurality of program names 904. In this case, the payload 112 includes a packet designation code 731 corresponding to each program name 904.

  The node management processor 102 creates the payload 112 of the forwarding table update request packet as follows.

  First, the node management processor 102 selects from the NIF processing code management table 740 a record whose processing content requested to the NIF 105 matches the NIF processing content 742 of the NIF processing code management table 740. Next, the NIF processing code 741 is extracted from the selected record. Then, the extracted NIF processing code 741 is stored in the payload 112 of the packet.

  The forwarding table update request packet requests the network interface 105 to update the forwarding table. Therefore, the node management processor 102 stores the NIF processing code 741 as “1” in the payload 112 of the packet.

  Next, the node management processor 102 selects, from the update code management table 750, a record whose forwarding table update content requested to the NIF 105 matches the NIF update content 752 of the update code management table 750. Next, the update code 751 is extracted from the selected record. Then, the extracted update code 751 is stored in the payload of the packet.

  The forwarding table update request packet in this explanatory diagram is transmitted in the process of adding the function expansion module 108 to the packet communication apparatus 101. In this case, a route is added to the forwarding table 401. Therefore, the node management processor 102 stores the update code 751 as “0” in the payload 112 of the packet.

  Next, the node management processor 102 extracts the internal address stored in the intra-node memory 104 in step 504. Next, the extracted internal address is stored in the payload 112 of the packet as the internal address 902 of the function expansion module added to the packet communication apparatus 101.

  Next, the node management processor 102 extracts the packet designation code 731 and the program name stored in the intra-node memory 104 in step 507. The extracted packet designation code 731 and program name are stored in the payload 112 of the packet.

  Returning now to FIG. When the node management processor 102 transmits a program installation request packet or a forwarding table update request packet to the network interface 105, the node management processor 102 updates the network interface program management table 800 (514).

  Specifically, the node management processor 102 matches the program name 904 stored in the packet (program installation request packet or forwarding table update request packet) with the program name 801 of the NIF-program management table 800, and further A circle is stored in a box in which the NIF number of the destination NIF 105 matches the NIF number 802 of the NIF-program management table 800.

  Next, the node management processor 102 selects the reference counter 803 of the record in which the program name 904 stored in the packet matches the program name 801 in the NIF-program management table 800. Then, the selected reference counter 803 is incremented.

  Next, the node management processor 102 measures the data amount of the program 903 stored in the program installation request packet. Next, the memory remaining rate 804 of the record in which the NIF number of the NIF 105 as the packet transmission destination matches the NIF number 802 of the NIF-program management table 800 is selected. Then, based on the measured data amount, the selected memory remaining rate is changed.

  Next, the node management processor 102 performs program storage processing (515). Details of the program storage process will be described with reference to FIG.

  On the other hand, the network interface 105 receives a packet from the node management processor 102. Next, the NIF 105 extracts the NIF processing code from the payload 112 of the received packet (516).

  Next, the NIF 105 selects a record in which the extracted NIF processing code matches the NIF processing code 741 of the NIF processing code management table 740 from the NIF processing code management table 740. Next, the NIF 105 extracts the NIF processing content 742 from the selected record. Then, the NIF 105 performs processing corresponding to the extracted NIF processing content 742.

  Specifically, if the extracted NIF processing code 741 is “0”, the NIF 105 determines that the received packet is a program installation request packet. Therefore, the network interface 105 extracts the program 903 from the payload 112 of the received packet. Next, the network interface 105 installs the extracted program 903.

  Next, the network interface 105 updates the forwarding table 401 (517-1).

  Specifically, the network interface 105 extracts the packet designation code 731 from the payload 112 of the received packet. Next, the network interface 105 selects, from the packet designation code management table 730, a record in which the extracted packet designation code matches the packet designation code 731 in the packet designation code management table 730. Next, the packet type 732 is extracted from the selected record.

  Next, the network interface 105 adds a new record to the forwarding table 401. Next, the network interface 105 stores the extracted packet type 732 in the payload type 405 and the IP address / prefix length 406 of the new record.

  Next, the network interface 105 extracts the internal address 902 and program name 904 of the function expansion module from the payload of the received packet. Next, the network interface 105 stores the extracted internal address 902 and program name 904 of the function expansion module in the processing content 403 of the added new record.

  In this way, the network interface 105 updates the forwarding table 401. Then, the packet communication apparatus 101 ends the addition process of the function expansion module 108 (518).

  If the extracted NIF processing code 741 is “1”, the network interface 105 determines that the received packet is a forwarding table update request packet. Therefore, the network interface 105 updates the forwarding table 401 (517-2).

  Specifically, the network interface 105 extracts an update code from the received packet. Next, the network interface 105 selects, from the update code management table 750, a record in which the extracted update code matches the update code 751 of the update code management table 750. Next, the NIF update content 752 is extracted from the selected record.

  Then, the NIF 105 determines the content to update the forwarding table 401 based on the extracted NIF update content 752.

  Here, the network interface 105 adds a path to the forwarding table 401 because the extracted update code 751 is “0”. Therefore, the network interface 105 extracts the packet designation code 731 from the payload 112 of the received packet. Next, the network interface 105 selects, from the packet designation code management table 730, a record in which the extracted packet designation code matches the packet designation code 731 in the packet designation code management table 730. Next, the packet type 732 is extracted from the selected record.

  Next, the network interface 105 adds a new record to the forwarding table 401. Next, the network interface 105 stores the extracted packet type 732 in the payload type 405 and the IP address / prefix length 406 of the new record.

  Next, the network interface 105 extracts the internal address 902 and program name 904 of the function expansion module from the payload 112 of the received packet. Next, the network interface 105 stores the extracted internal address 902 and program name 904 of the function expansion module in the processing content 403 of the added new record.

  In this way, the network interface 105 updates the forwarding table 401. Then, the packet communication apparatus 101 ends the addition process of the function expansion module 108 (518).

  If the extracted processing code 741 is “2”, the network interface 105 determines that the received packet is a program uninstallation request packet. Therefore, the network interface 105 extracts the program name 904 from the payload 112 of the received packet. Next, the network interface 105 deletes the extracted program with the program name 904.

  Next, the network interface 105 updates the forwarding table 401 (517-3). Here, the network interface 105 deletes the route from the forwarding table 401.

  Specifically, the network interface 105 extracts the packet designation code 731 from the payload 112 of the received packet. Next, the network interface 105 selects, from the packet designation code management table 730, a record in which the extracted packet designation code matches the packet designation code 731 in the packet designation code management table 730. Next, the packet type 732 is extracted from the selected record.

  Next, the network interface 105 selects, from the forwarding table 401, a record in which the extracted packet type 732 matches the header information 402 of the forwarding table 401. Then, the network interface 105 deletes the selected record from the forwarding table 401.

  In this way, the network interface 105 updates the forwarding table 401. Then, the packet communication apparatus 101 ends the addition process of the function expansion module 108 (518).

  FIG. 11A is a configuration diagram of the module-program management table 820 according to the embodiment of this invention.

  The module-program management table 820 is stored in the intra-node memory 104.

  The module-program management table 820 shows the correspondence between the function expansion module 108 and the program.

  The module type 822 is a unique identifier of a service realized by the function expansion module 108. The program name 821 is a unique identifier of the program.

  When the function expansion module 108 of the module type 822 uses the program with the program name 821, a circle is stored in the corresponding box of the module-program management table 820.

  Further, the module-program management table 820 includes a reference counter (ref) 823, saved contents 824, and packet designation code 825.

  The reference counter 823 is the number of function expansion modules 108 using the program. The number of reference counters 823 is the same as the number of circles stored in the record corresponding to the program.

  A storage method 824 indicates a method of storing the program.

  Specifically, when the storage method 824 is “1”, the intra-node memory 104 stores the program. If the storage method 824 is “2”, the in-node memory 104 stores program location information. When the storage method 824 is “3”, the in-node memory 104 stores neither the program nor the program location information, but the function expansion module 108 stores the program. If the storage method 824 is “4”, the intra-node memory 104 stores neither the program nor the program location information, but the function expansion module 108 stores the program location information.

  The packet designation code 825 is a unique identifier of the type of packet processed by the function expansion module 822. The packet designation code 825 uses the same identifier as the packet designation code 731 in the packet designation code management table 730.

  By storing the program management table 1212 in the intra-node memory 104, the node management processor 102 can quickly determine a method and a place where the program is acquired.

  FIG. 11B is a flowchart of the program storage process of the node management processor 102 according to the embodiment of this invention.

  When the node management processor 102 updates the NIF-program management table 800 in step 514 of the function expansion module addition process (FIG. 8), the node management processor 102 starts the program storage process (515).

  First, it is determined whether or not the capacity for storing the program acquired in steps 506-1 to 506-3 of the function expansion module addition process (FIG. 8) remains in the intra-node memory 104 (1202).

  If the storage capacity remains, the program is stored in the intra-node memory 104 (1203). Then, the process proceeds to Step 1210.

  On the other hand, if the storage capacity does not remain, a record in which the program name of the program matches the program name 821 of the module-program management table 820 is selected. Next, the reference counter 823 is extracted from the selected record. Next, all the records whose storage method 824 of the module-program management table 820 is “1” are selected.

  Next, the extracted reference counter is compared with the reference counter 823 of all records whose storage method 824 is “1”. Then, it is determined whether or not the extracted reference counter is the smallest among all the compared reference counters 823 (1204).

  If the extracted reference counter is minimum, it is determined that the program is not saved. Therefore, it is determined whether the location information of the program can be acquired from the function expansion module 108 (1205).

  If the location information of the program cannot be acquired, the process proceeds to step 1210 as it is.

  On the other hand, if the location information of the program can be acquired, the acquired location information of the program is stored in the intra-node memory 104 (1206). Then, the process proceeds to Step 1210.

  On the other hand, if it is determined in step 1204 that the extracted reference counter is not the minimum, all program names 821 corresponding to the reference counter 823 having a value smaller than the extracted reference counter are extracted from the module-program management table 820.

  Next, when all the programs having the extracted program names are deleted, it is determined whether or not a capacity for storing the programs can be secured in the in-node memory 104 (1207).

  If it is determined that the storage capacity of the program cannot be secured, the process proceeds to step 1205.

  On the other hand, if it is determined that the storage capacity of the program can be secured, the reference counter 823 in the module-program management table 820 is deleted from the intra-node memory 104 in order from the smallest program (1208). The deletion of the program is repeated until the storage capacity of the program is secured in the intra-node memory 104.

  Note that the reference counter 823 may be deleted in order from the program with the oldest stored date and time, instead of deleting in order from the smallest program.

  When the intra-node memory 104 secures the storage capacity of the program, the intra-node memory 104 stores the program (1209).

  Next, the node management processor 102 updates the module-program management table 820 (1210).

  Specifically, a new record is added to the module-program management table 820. Next, the type of the function expansion module 108 added in step 501 (FIG. 8) is stored in the module type 822 of the new record.

  Next, a box in which the program name stored in the intra-node memory 104 matches the program name 821 of the module-program management table 820 is selected from the new record. Then, a circle is stored in the selected box.

  Next, a record in which the program name of the program stored in the intra-node memory 104 matches the program name 821 of the module-program management table 820 is selected from the module-program management table 820. Next, the reference counter 823 of the selected record is incremented.

  Next, when there is a change in the storage method of the program, the storage method 824 of the selected record is changed to a corresponding value.

  When the module-program management table 820 is updated in this way, the program storage process is terminated (1211).

  If there are a plurality of programs acquired in steps 506-1 to 506-3 (FIG. 8), the program storage process is repeated the same number of times as the number of programs.

  As described above, the intra-node memory 104 stores a program installed by the network interface 105. This eliminates the need for the node management processor 102 to acquire a program from the function expansion module 108 or an external device when transmitting the program to the network interface 105. That is, since the node management processor 102 acquires the program to be transmitted to the NIF 105 from the intra-node memory 104, the processing speed can be increased.

  The intra-node memory 104 stores a program with a large reference counter 801. That is, the node management processor 102 can acquire a program that is highly likely to be transmitted to the NIF 105 from the intra-node memory 104. Therefore, the node management processor 102 can reduce the number of times the program is acquired from the function expansion module 108.

  Further, the in-node memory 104 stores the location information of the program when the program cannot be stored. Thus, the node management processor 102 can omit the process of inquiring the function expansion module 108 for the location information of the program.

  FIG. 12 is a sequence diagram of the function expansion module addition processing of the packet communication apparatus 101 according to the embodiment of this invention.

  This sequence diagram shows typical processing of the packet communication apparatus 101 to which the function expansion module 108 is added.

  First, the function expansion module 108 is added to the module I / F 106. Then, the function expansion module 108 creates an installation request internal packet in which the program is stored in the payload 112. Then, the function expansion module 108 transmits the created installation request internal packet to the node management processor 102 (1001).

  Then, the node management processor 102 receives the installation request internal packet from the function expansion module 108. Next, the node management processor 102 transmits to the operator control terminal 103 a request for specifying the NIF 105 for installing the program (1002).

  Then, the operator control terminal 103 displays the contents of the received designation request. The operator control terminal 103 receives the designation of the NIF 105 from the operator. Here, it is assumed that the operator has designated NIF (1) 105, NIF (2), and NIF (3). Then, the operator control terminal 103 transmits an NIF designation response including the input content to the node management processor 102 (1003).

  The node management processor 102 receives the NIF designation response from the operator management terminal 103. Then, the node management processor 102 stores the internal address of the NIF 105 designated by the received NIF designation response in the destination address, and further creates a program installation request packet in which the program is stored in the payload 112.

  Then, the node management processor 102 transmits the created program installation request packet to all the NIFs 105 designated by the NIF designation response (1004). That is, the node management processor 102 transmits a program installation request packet to the NIF (1) 105, the NIF (2), and the NIF (3).

  Upon receiving the program installation request packet, the network interface 105 installs the program stored in the received packet.

  Then, the packet communication device 101 ends the process of adding the function expansion module 108.

  Next, the effect of the packet communication apparatus 101 of this embodiment will be described.

  Here, a case will be described in which the function expansion module 108 to be added is a service denial (DoS) attack countermeasure module.

  The DoS attack countermeasure module first collects flow statistical information from the header of the packet. The flow statistical information includes an address and a port number. Next, the DoS attack countermeasure module identifies the characteristics of the packet related to the DoS attack by analyzing the collected flow statistical information. Then, when receiving a packet having the specified characteristics, the DoS attack countermeasure module discards the packet without forwarding it.

  Here, in order to clarify the effect of the present invention, processing of a conventional fixed transfer apparatus to which a DoS attack countermeasure module is added will be described.

  The configuration of the conventional fixed transfer apparatus may or may not be the same as that of the packet communication apparatus 101 (FIG. 1-1) of the present embodiment. Here, in order to facilitate comparison with the present embodiment, the case of the same configuration will be described.

  FIG. 13A is a flowchart of the packet transfer process of the conventional fixed transfer apparatus.

  First, the network interface 105 receives a packet from the external network 110 (1101).

  Next, the network interface 105 stores the received packet in the intra-NIF memory 302 (1102).

  Next, the network interface 105 extracts a header from the packet stored in the intra-NIF memory 302. Next, the network interface 105 compares the extracted header with the forwarding table 401 to determine a packet transfer destination. Here, the network interface 105 determines the DoS attack countermeasure module as the transfer destination.

  Next, the network interface 105 adds an internal header whose destination address is the internal address of the DoS attack countermeasure module to the packet stored in the intra-NIF memory 302. Next, the network interface 105 transmits the packet with the internal header added to the DoS attack countermeasure module via the internal switch 109 (1103).

  When receiving the packet, the DoS attack countermeasure module processes the received packet (1104). Specifically, the DoS attack countermeasure module deletes the internal header from the received packet. Next, the DoS attack countermeasure module collects flow statistical information from the header of the packet from which the internal header is deleted. Next, the DoS attack countermeasure module identifies the characteristics of the packet related to the DoS attack by analyzing the collected flow statistical information.

  Next, the DoS attack countermeasure module determines whether or not to transfer the packet to another part in the apparatus (1105). Specifically, when the DoS attack countermeasure module has the characteristics of a packet related to the DoS attack, the DoS attack countermeasure module determines that the packet is not transferred to another part in the apparatus.

  When the DoS attack countermeasure module determines that the packet is not transferred, the DoS attack countermeasure module discards the packet. Then, the fixed transfer device ends the packet transfer process.

  On the other hand, when the DoS attack countermeasure module determines to transfer a packet, the DoS attack countermeasure module determines the transfer destination of the packet by comparing the header of the packet with the forwarding table. Here, the DoS attack countermeasure module determines the network interface 105 as the transfer destination.

  Next, the DoS attack countermeasure module adds an internal header having the destination address as the internal address of the network interface 105 determined as the transfer destination. Next, the DoS attack countermeasure module transmits the packet with the internal header added to the destination network interface 105 via the internal switch 109 (1106).

  Then, the network interface 105 stores the packet received from the DoS attack countermeasure module in the intra-NIF memory 302 (1107).

  The NIF 105 deletes the internal header from the packet stored in the NIF internal memory 302. Next, the network interface 105 determines the packet transfer destination by comparing the header of the packet from which the internal header is deleted with the forwarding table 401. Here, the network interface 105 determines the external network 110 as the transfer destination.

  Next, the network interface 105 replaces the header of the packet stored in the intra-NIF memory 302 with a header destined for the external network 110.

  Next, the network interface 105 transmits the packet to the external network 110 (1108). Then, the conventional fixed transfer apparatus ends the packet transfer process (1109).

  A conventional fixed transfer apparatus transfers a packet as described above.

  In the conventional fixed transfer device, the network interface 105 needs to transfer all received packets to the DoS attack countermeasure module. This is the same if the function expansion module connected to the fixed transfer device is a module that analyzes or filters packets as well as a DoS attack countermeasure module.

  The DoS attack countermeasure module performs advanced analysis processing on all forwarded packets. Therefore, the processing of the DoS attack countermeasure module has reduced the throughput of the entire apparatus.

  In addition, the DoS attack countermeasure module transfers the analyzed packet to the network interface 105. For this reason, the DoS attack countermeasure module needs to include the forwarding table 401. Further, the DoS attack countermeasure module needs to manage the packet transfer path.

  The packet communication apparatus 101 of this embodiment can perform packet transfer processing that solves these problems.

  FIG. 13-2 is a flowchart of packet transfer processing of the packet communication apparatus 101 according to the embodiment of this invention.

  In the packet communication apparatus 101 of this embodiment, a program can be installed in the network interface 105. Here, the network interface 105 is installed with a program corresponding to the DoS attack countermeasure module. The program copies the header of the packet received from the external network 110 and transfers only the copied header to the DoS attack countermeasure module.

  Hereinafter, packet transfer processing of the packet communication apparatus 101 when the NIF 105 installed with the program receives a packet will be described.

  First, the network interface 105 receives a packet from the external network 110 (1111).

  Next, the network interface 105 stores the received packet in the intra-NIF memory 302 (1112).

  Next, the network interface 105 extracts a header from the packet stored in the intra-NIF memory 302. Next, the network interface 105 compares the extracted header with the forwarding table 401 to determine the transfer destination and the processing content (1113). Here, the network interface 105 determines the network interface 105 connected to the external network 110 that transfers the packet as the transfer destination. The network interface 105 determines the execution of the program corresponding to the DoS attack countermeasure module as the processing content.

  Next, the network interface 105 processes the packet by executing the program. Specifically, the network interface 105 copies the packet header stored in the intra-NIF memory 302. Then, the network interface 105 transfers only the copied header to the DoS attack countermeasure module (1114).

  Next, the network interface 105 adds an internal header to the packet stored in the intra-NIF memory 301 with the internal address of the transfer destination network interface 105 determined in step 1113 as the destination address. Next, the NIF 105 transmits the packet with the internal header added thereto to the transfer destination NIF 105 via the internal switch 109 (1116).

  Then, the transfer destination NIF 105 stores the received packet in the in-NIF memory 302 (1117).

  The transfer destination NIF 105 deletes the internal header from the packet stored in the NIF internal memory 302. Next, the forwarding destination NIF 105 determines the forwarding destination of the packet by comparing the header of the packet from which the internal header has been deleted with the forwarding table 401. Here, the transfer destination NIF 105 determines the external network 110 as the transfer destination.

  Next, the transfer destination NIF 105 replaces the header of the packet stored in the NIF internal memory 302 with a header destined for the external network 110.

  Next, the transfer destination NIF 105 transmits the packet to the external network 110 (1118). Then, the packet communication apparatus 101 ends the packet transfer process (1119).

  On the other hand, the DoS attack countermeasure module that has received the header from the network interface 105 in step 1114 processes the received header (1115). Specifically, the DoS attack countermeasure module collects flow statistical information from the received header. Next, the DoS attack countermeasure module identifies the characteristics of the header related to the DoS attack by analyzing the collected flow statistical information.

  When the DoS attack countermeasure module identifies the header characteristics related to the DoS attack, the DoS attack countermeasure module requests the network interface 105 to change the forwarding table 401. This request includes header features related to the DoS attack.

  Upon receiving the request, the NIF 105 changes the forwarding table 401. In the forwarding table 401, the processing content 403 corresponding to the packet having the header characteristics related to the DoS attack is discarded.

  The packet communication apparatus 101 of this embodiment transfers a packet as described above.

  In the packet communication apparatus 101 of the present embodiment, the network interface 105 copies an important part related to the DoS attack of the packet (for example, the header of the SYN packet) and transfers only the copied part to the DoS attack countermeasure module.

  That is, the network interface 105 does not need to transfer the packet itself to the Dos attack countermeasure module. For this reason, the packet communication apparatus 101 according to the present embodiment transfers the packet without being affected by the processing of the DoS attack countermeasure module, so that the throughput of the entire apparatus can be maintained.

  In addition, the DoS attack countermeasure module connected to the packet communication apparatus 101 according to the present embodiment does not transfer a packet, and therefore does not need to include the forwarding table 401.

  In addition, since the DoS attack countermeasure module connected to the packet communication apparatus 101 according to the present embodiment receives only information necessary for processing, the load is reduced.

  Further, the NIF 105 of the packet communication apparatus 101 according to the present embodiment can change the installed program. For example, when an important part related to the DoS attack of a packet changes, the network interface 105 changes the installed program. Therefore, the packet communication apparatus 101 can quickly cope with a change in an important part related to a packet DoS attack.

  FIG. 14A is a flowchart of the function expansion module deletion process of the packet communication apparatus 101 according to the embodiment of this invention.

  The function expansion module 108 is removed from the module I / F 106 (1901). As a result, the packet communication apparatus 101 starts the deletion process of the function expansion module 108.

  Specifically, the function expansion module 108 detects that its own module internal I / F 310 has been removed from the module I / F 106 of the packet communication apparatus 101. When detecting the removal, the function expansion module 108 transmits a function expansion module deletion request to the node management processor 102.

  Upon receiving the request, the node management processor 102 updates the module-program management table 820 (1902).

  Specifically, the node management processor 102 deletes, from the module-program management table 820, a record in which the service realized by the removed function expansion module 108 matches the module type 822 of the module-program management table 820. .

  Further, the node management processor 102 selects a record in which the program name corresponding to the removed function expansion module 108 matches the program name 821 of the module-program management table 820. Next, the reference counter 823 of the selected record is decreased.

  Next, the node management processor 102 determines whether or not even one “0” exists in the reference counter 823 of the updated module-program management table 820 (1903).

  If no “0” exists in the reference counter 823, the node management processor 102 determines that it is not necessary to delete the program from the network interface 105. Therefore, the node management processor 102 transmits a forwarding table update request packet to the network interface 105 (1904).

  FIG. 14B is a configuration diagram of a forwarding table update request packet according to the embodiment of the present invention.

  The forwarding table update request packet includes an internal header 111 and a payload 112.

  The internal header 111 includes a destination address 601 and a transmission source address 602.

  The destination address 601 is an internal address of a part in the apparatus that receives the packet. The transmission source address 602 is an internal address of a part in the device that transmits the packet.

  In the forwarding table update request packet, the destination address 601 is the internal address of the NIF 105. A source address 602 is an internal address of the node management processor 102.

  The payload 112 includes an NIF processing code 741, an update code 751, and an internal address 902.

  The node management processor 102 creates the payload 112 of the forwarding table update request packet as follows.

  First, the node management processor 102 selects from the NIF processing code management table 740 a record whose processing content requested to the NIF 105 matches the NIF processing content 742 of the NIF processing code management table 740. Next, the NIF processing code 741 is extracted from the selected record. Then, the extracted NIF processing code 741 is stored in the payload 112 of the packet.

  The forwarding table update request packet requests the network interface 105 to update the forwarding table 401. Therefore, the node management processor 102 stores the NIF processing code 714 as “1” in the payload 112 of the packet.

  Next, the node management processor 102 selects, from the update code management table 750, a record in which the update content of the forwarding table 401 requested to the NIF 105 matches the NIF update content 752 of the update code management table 750. Next, the update code 751 is extracted from the selected record. Then, the extracted update code 751 is stored in the payload of the packet.

  The forwarding table update request packet in this explanatory diagram is transmitted in the process of deleting the function expansion module 108 from the packet communication apparatus 101. In this process, the network interface 105 deletes the route from the forwarding table 401. Therefore, the node management processor 102 stores the update code 751 as “1” in the payload 112 of the packet.

  Next, the node management processor 102 stores the internal address of the function expansion module 108 removed in step 1901 in the payload 112 of the packet as the internal address 902 of the function expansion module that deletes the path.

  Returning now to FIG.

  The NIF 105 receives the forwarding table update request packet.

  Next, the network interface 105 extracts the network interface processing code from the payload 112 of the received forwarding table update request packet.

  Next, the NIF 105 selects a record in which the extracted NIF processing code matches the NIF processing code 741 of the NIF processing code management table 740 from the NIF processing code management table 740. Next, the NIF 105 extracts the NIF processing content 742 from the selected record. Then, the NIF 105 performs processing corresponding to the extracted NIF processing content 742.

  That is, since the extracted NIF processing code 741 is “1”, the network interface 105 determines that the received packet is a forwarding table update request packet. Therefore, the network interface 105 updates the forwarding table 401 (1905).

  Specifically, the network interface 105 extracts an update code from the received packet. Next, the network interface 105 selects, from the update code management table 750, a record in which the extracted update code matches the update code 751 of the update code management table 750. Next, the NIF update content 752 is extracted from the selected record.

  Then, the NIF 105 determines the content to update the forwarding table 401 based on the extracted NIF update content 752.

  Here, the network interface 105 deletes the route from the forwarding table 401 because the extracted update code 751 is “1”.

  Therefore, the network interface 105 extracts the internal address 902 of the function expansion module from the payload 112 of the received packet. Next, the network interface 105 deletes from the forwarding table 401 all records in which the extracted internal address 902 of the function expansion module is included in the processing content 403 of the forwarding table 401.

  As described above, the network interface 105 deletes the route to the removed function expansion module 108 from the forwarding table 401.

  Then, the packet communication apparatus 101 ends the function expansion module deletion process (1908).

  On the other hand, if “0” exists in the reference counter 823 in step 1903, the network interface 105 stores a program that is not used at all by all the function expansion modules 108. Therefore, the node management processor 102 requests the NIF 105 to delete the program whose reference counter 823 is “0”. That is, the node management processor 102 transmits a program deletion request packet to the network interface 105 (1906).

  Note that “2” is stored as the NIF processing code 741 in the program deletion request packet. Further, the name of the program requesting deletion is stored in the NIF 105. Furthermore, the internal address of the removed function expansion module is stored.

  Further, when a program requesting the NIF 105 to be deleted is stored in the in-node memory 104, the node management processor 102 may delete the program from the in-node memory 104.

  The NIF 105 receives the program deletion request packet. Next, the NIF 105 extracts the NIF processing code from the received packet.

  Next, the NIF 105 selects a record in which the extracted NIF processing code matches the NIF processing code 741 of the NIF processing code management table 740 from the NIF processing code management table 740. Next, the NIF 105 extracts the NIF processing content 742 from the selected record. Then, the NIF 105 performs processing corresponding to the extracted NIF processing content 742.

  That is, since the extracted NIF processing code 741 is “2”, the network interface 105 determines that the received packet is a program deletion request packet. Therefore, the network interface 105 deletes the pro program and further updates the forwarding table 401 (1907).

  Specifically, the network interface 105 extracts a program name from the received program deletion request packet. The network interface 105 deletes the program with the extracted program name from the program memory 304.

  Next, the NIF 015 extracts the internal address of the function expansion module from the received program deletion request packet. Then, the network interface 105 deletes from the forwarding table 401 all records in which the extracted internal address 902 of the function expansion module is included in the processing content 403 of the forwarding table 401.

  As a result, the network interface 105 deletes the route to the removed function expansion module 108 from the forwarding table 401.

  Then, the packet communication apparatus 101 ends the function expansion module deletion process (1908).

  In step 1903, the node management processor 102 determines whether to request the NIF 105 to delete the program based on the reference counter 823 of the module-program management table 820. However, the node management processor 102 may make the determination based not only on the reference counter but also on the load state of the NIF 105 including the memory capacity of the program memory 304 of the NIF 105.

  FIG. 15 is a flowchart of NIF addition processing of the packet communication apparatus 101 according to the embodiment of this invention.

  A new NIF 105 is connected to the internal switch 109 (1301). As a result, the packet communication apparatus 101 starts the NIF addition process.

  Specifically, the network interface 105 detects that its own internal I / F 305 and the internal switch 109 are connected. When detecting the connection, the network interface 105 transmits a program transmission request packet to the node management processor 102 (1302).

  The program transmission request packet requests the node management processor 102 to transmit a program.

  FIG. 16A is a configuration diagram of a program transmission request packet according to the embodiment of the present invention.

  The program transmission request packet includes an internal header 111 and a payload 112.

  The internal header 111 includes a destination address 601 and a transmission source address 602.

  The destination address 601 is an internal address of a part in the apparatus that receives the packet. The transmission source address 602 is an internal address of a part in the device that transmits the packet.

  In the program transmission request packet, the destination address 601 is the internal address of the node management processor 102. Further, the internal address of the new NIF 105 to which the transmission source address 602 is added.

  The payload 112 includes a node management processor processing code 701 and a program designation code 761.

  The NIF 105 creates the payload 112 of the program transmission request packet as follows.

  First, the network interface 105 selects from the node management processor processing code management table 700 a record whose processing content requested to the node management processor 102 matches the processing content 702 of the node management processor processing code management table 700. Next, the node management processor processing code 701 is extracted from the selected record. The extracted node management processor processing code 701 is stored in the payload 112 of the packet.

  The program transmission request packet requests the node management processor 102 to transmit a program. Therefore, the function expansion module 108 stores the node management processor processing code 701 as “1” in the payload 112 of the packet.

  Next, the network interface 105 selects, from the program designation code management table 760, a record in which the program requesting installation matches the transmission program 762 in the program designation code management table 760. Next, the program designation code 761 is extracted from the selected record. The extracted program designation code 761 is stored in the payload 112 of the packet.

  The program transmission request packet in this explanatory diagram is a case where the operator specifies a program to be installed by the network interface 105. Therefore, the network interface 105 stores the program designation code 761 as “1” in the payload 112 of the packet.

  The NIF 105 stores the program name of the requested program together with the payload of the packet when storing the program designation code 762 as “2” in the payload 112 of the packet.

  Returning now to FIG.

  The node management processor 102 receives the program transmission request packet. Then, the node management processor 102 extracts the node management processor processing code from the payload 112 of the received program transmission request packet.

  Next, the node management processor 102 stores a record in which the extracted node management processor processing code matches the node management processor processing code 701 in the node management processor processing code management table 700 (FIG. 5A). The management processor processing code management table 700 is selected. Next, the processing content 702 is extracted from the selected record.

  Then, the node management processor 102 performs processing corresponding to the extracted processing content 702 (1303). Here, since the node management processor processing code is “1”, the designated program is transmitted to the network interface 105.

  Specifically, the node management processor 102 extracts a program designation code from the received program transmission request packet.

  Next, the node management processor 102 selects, from the program designation code management table 760, a record in which the extracted program designation code matches the program designation code 761 of the program designation code management table 760. Next, the transmission program 762 is extracted from the selected record.

  Next, the node management processor 102 determines a program to be transmitted to the network interface 105 based on the extracted transmission program 762.

  Specifically, if the extracted program designation code is “0”, the node management processor 102 determines that all programs related to the function expansion module 108 are to be transmitted, and proceeds to step 1307.

  If the extracted program designation code is “2”, the node management processor 102 extracts the program name from the received program transmission request packet. Then, the node management processor 102 determines to transmit the program having the extracted program name, and proceeds to step 1307.

  Further, when the extracted program designation code is “1”, the node management processor 102 determines that the operator designates a program to be transmitted to the network interface 105. Therefore, the node management processor 102 transmits a program designation request to the operator control terminal 103. The program designation request includes the NIF number of the new NIF added.

  Then, the operator control terminal 103 displays information corresponding to the received program designation request.

  FIG. 17 is an explanatory diagram of a display screen of the operator control terminal 103 that has received the program designation request according to the embodiment of this invention.

  The operator control terminal 103 displays a module-program management table 820 and the like.

  The operator can grasp the correspondence between the function expansion module 108 and the program by referring to the module-program management table 820 displayed on the operator control terminal 103. Therefore, the operator can determine a program to be installed in the newly added NIF 105. Then, the operator designates the determined program on the operator control terminal 103.

  However, the amount of information displayed on this display screen is large. Therefore, it is difficult for an operator to intuitively determine a program to be installed in the NIF 105. Therefore, the operator control terminal 103 may display as follows.

  FIG. 18A is an explanatory diagram of a display screen of the operator control terminal 103 that has received the program designation request according to the embodiment of this invention.

  The operator control terminal 103 displays all types of services provided by the function expansion module 108.

  Then, the operator selects on the operator control terminal 103 a service desired to be realized by the newly added NIF 105.

  Then, the operator control terminal 103 determines a program used by the function expansion module that provides the selected service from the module program management table 820. Then, the determined program is set as a program designated by the user.

  In addition, the operator control terminal 103 may display as follows.

  FIG. 18-2 is an explanatory diagram of a display screen of the operator control terminal 103 that has received the program designation request according to the embodiment of this invention.

  The operator control terminal 103 displays the NIF-program management table 800 and the like.

  In this case, the operator can designate the same program as the program stored in the NIF 105 already connected to the packet communication apparatus 101 (existing NIF 105). Therefore, the operator can easily specify a program with few setting errors.

  For example, the operator selects one of the existing NIFs 105 on the operator control terminal 103.

  Then, the operator control terminal 103 determines the program stored in the selected NIF 105 from the NIF-program management table 800. Then, the determined program is set as a program designated by the user.

  Returning now to FIG.

  Next, the operator designates a program to be installed in the newly added NIF 105 on the operator control terminal 103 (1306). Then, the operator control terminal 103 notifies the node management processor 102 of the designated program.

  Next, the node management processor 102 refers to the storage method 824 of the module-program management table 820 to determine the storage location of the notified program or the location information of the notified program.

  Then, the node management processor 102 determines whether or not the designated program is stored in the intra-node memory 104 (1307).

  When the designated program is stored in the in-node memory 104, the node management processor 102 acquires the program from the in-node memory 104. Then, the process proceeds to Step 1315.

  On the other hand, if the designated program is not stored in the intra-node memory 104, the node management processor 102 cannot acquire the program from the intra-node memory 104. Therefore, the node management processor 102 determines whether the location information of the designated program is stored in the intra-node memory 104 (1308).

  When the location information is stored in the in-node memory 104, the node management processor 102 acquires the program from a server or a node corresponding to the location information (1309). Then, the process proceeds to Step 1315.

  On the other hand, if the location information is not stored in the intra-node memory 104, the node management processor 102 determines that information regarding the program cannot be acquired from the intra-node memory 104. Therefore, the node management processor 102 identifies the function expansion module 108 storing the program by referring to the module-program management table 820. Next, the node management processor 102 transmits a program request packet to the identified function expansion module 108 (1310).

  FIG. 16B is a configuration diagram of a program request packet according to the embodiment of the present invention.

  The program request packet includes an internal header 111 and a payload 112.

  The internal header 111 includes a destination address 601 and a transmission source address 602.

  The destination address 601 is an internal address of a part in the apparatus that receives the packet. The transmission source address 602 is an internal address of a part in the device that transmits the packet.

  In the program request packet, the destination address 601 is the internal address of the function expansion module 108. A source address 602 is an internal address of the node management processor 102.

  The payload 112 includes a module processing code 771 and a program name 904.

  The node management processor 102 creates the payload 112 of the program request packet as follows.

  First, by referring to the storage method 824 of the module-program management table 820, it is determined whether the function expansion module 108 stores the program or the location information of the program.

  Specifically, when the storage method 824 of the module-program management table 820 is “3”, it is determined that the function expansion module 108 stores the program. Therefore, since the program is requested to the function expansion module 108, the module processing code 771 is set to “1” and stored in the payload 112 of the packet.

  On the other hand, if the storage method 824 of the module-program management table 820 is “4”, it is determined that the function expansion module 108 stores the program location information. Accordingly, since the location information of the program is requested to the function expansion module 108, the module processing code 771 is stored as "2" in the payload 112 of the packet.

  Further, the program name 906 of the program requested to the function expansion module 108 is stored in the packet payload.

  Returning now to FIG.

  The function enhancement module 108 receives the program request packet. Next, the function expansion module 108 extracts a module processing code from the payload 112 of the received program request packet.

  Next, the function expansion module 108 selects, from the module processing code management table 770, a record in which the extracted module processing code matches the module processing code 771 of the module processing code management table 770. Next, module processing content 772 is extracted from the selected record. Then, the function expansion module 108 performs processing corresponding to the extracted module processing content 772.

  Specifically, the function expansion module 108 determines whether the extracted module processing code is “0” or “1” (1311).

  If the extracted module processing code is “0”, the function expansion module 108 is requested for program location information. Therefore, the function enhancement module 108 extracts the program name 904 from the payload 112 of the received program request packet.

  Next, the function expansion module 108 transmits the location information of the extracted program with the program name 904 to the node management processor 102 (1314).

  Then, the node management processor 102 stores the received program location information in the in-node memory 104.

  Then, the process returns to Step 1308. In this case, the node management processor 102 determines that the location information of the program is stored in the in-node memory. Therefore, the node management processor 102 acquires a program from a server or a node corresponding to the location information (1309). Then, the process proceeds to Step 1315.

  On the other hand, the function expansion module 108 is requested to program if the extracted module processing code is “1”. Therefore, the function expansion module 108 extracts the program name 904 from the payload 112 of the received program request packet.

  Next, the function expansion module 108 transmits the extracted program with the program name 904 to the node management processor 102 (1312).

  Then, the node management processor 102 receives the program from the function expansion module 108 (1313).

  Next, the node management processor 102 transmits a program installation request packet including the received program to the newly added NIF 105 (1315).

  FIG. 19A is a configuration diagram of a program installation request packet according to the embodiment of the present invention.

  The program installation request packet includes an internal header 111 and a payload 112.

  The internal header 111 includes a destination address 601 and a transmission source address 602.

  The destination address 601 is an internal address of a part in the apparatus that receives the packet. The transmission source address 602 is an internal address of a part in the device that transmits the packet.

  In the program installation request packet, the destination address 601 is an internal address of the newly added NIF 105. A source address 602 is an internal address of the node management processor 102.

  The payload 112 includes an NIF processing code 741, an internal address 1701 of the function expansion module, a packet designation code 731, a program 903, and a program name 904. The internal address 1701, the packet designation code 731, the program 903, and the program name of the function expansion module are collectively used as update information 1702.

  The payload 112 may include a plurality of function expansion module internal addresses 1701. In this case, the payload 112 includes a packet designation code 731 corresponding to each function expansion module 108.

  The node management processor 102 creates the payload 112 of the program installation request packet as follows.

  First, the node management processor 102 selects from the NIF processing code management table 740 a record whose processing content requested to the NIF 105 matches the NIF processing content 742 of the NIF processing code management table 740. Next, the NIF processing code 741 is extracted from the selected record. The extracted NIF processing code 741 is stored in the payload 112 of the packet.

  The program installation request packet requests the network interface 105 to install the program 903 stored in the payload. Therefore, the node management processor 102 stores the NIF processing code 714 as “0” in the payload 112 of the packet.

  Next, the node management processor 102 refers to the module-program management table 820 to identify the function expansion module 108 that uses the program. Further, the node management processor 102 specifies the packet designation code of the packet to be processed by the specified function expansion module 108. Then, the node management processor 102 stores the identified internal address 902 and the packet designation code 731 of the function expansion module 108 in the payload 112 of the packet.

  The node management processor 102 stores the program acquired from the intra-node memory 102 or the function expansion module 108 in the payload 112 of the packet.

  FIG. 19-2 is a configuration diagram of a program installation request packet according to the embodiment of the present invention.

  The program installation request packet of this explanatory diagram includes a plurality of update information 1702. On the other hand, the program installation request packet in FIG. 19A includes only one piece of update information 1702.

  That is, the program installation request packet may include any number of update information 1702.

  The rest of the configuration of the program installation request packet in this explanatory diagram is the same as that of the program installation request packet in FIG. Therefore, the same number is attached | subjected to the same structure and description is abbreviate | omitted.

  Returning now to FIG.

  When the node management processor 102 transmits the program installation request packet, the node management processor 102 updates the NIF-program management table 800 (1316).

  Specifically, the node management processor 102 matches the program name 904 stored in the program installation request packet with the program name 801 of the NIF-program management table 800, and further, the NIF number of the NIF 105 that is the transmission destination of the packet. A circle is stored in a box that matches the NIF number 802 of the NIF-program management table 800.

  Next, the node management processor 102 measures the data amount of the program 903 stored in the program installation request packet. Next, the memory remaining rate 804 of the record in which the NIF number of the NIF 105 as the packet transmission destination matches the NIF number 802 of the NIF-program management table 800 is selected. Then, based on the measured data amount, the selected memory remaining rate is changed.

  Next, the node management processor 102 performs a program storage process (FIG. 11-2) (1317).

  On the other hand, the network interface 105 receives a program installation request packet from the node management processor 102. Then, the NIF 105 extracts the NIF processing code from the payload 112 of the received program installation request packet.

  Next, the NIF 105 selects a record in which the extracted NIF processing code matches the NIF processing code 741 of the NIF processing code management table 740 from the NIF processing code management table 740. Next, the NIF 105 extracts the NIF processing content 742 from the selected record. Then, the NIF 105 performs processing corresponding to the extracted NIF processing content 742.

  Specifically, the NIF 105 determines that the received packet is a program installation request packet because the extracted NIF processing code 741 is “0”. Therefore, the network interface 105 extracts the program 903 from the payload 112 of the received program installation request packet. Next, the network interface 105 installs the extracted program 903.

  Further, the network interface 105 updates the forwarding table 401 (1318).

  Specifically, the network interface 105 extracts the packet designation code 731 from the payload 112 of the received packet. Next, the network interface 105 selects, from the packet designation code management table 730, a record in which the extracted packet designation code matches the packet designation code 731 in the packet designation code management table 730. Next, the packet type 732 is extracted from the selected record.

  Next, the network interface 105 adds a new record to the forwarding table 401. Next, the network interface 105 stores the extracted packet type 732 in the payload type 405 and the IP address / prefix length 406 of the new record.

  Next, the network interface 105 extracts the internal address 902 and program name 904 of the function expansion module from the payload 112 of the received packet. Next, the network interface 105 stores the extracted internal address 902 and program name 904 of the function expansion module in the processing content 403 of the added new record.

  In this way, the network interface 105 updates the forwarding table 401. Then, the packet communication apparatus 101 ends the addition process of the function expansion module 108 (1319).

  FIG. 20 is a sequence diagram of NIF addition processing of the packet communication device according to the embodiment of this invention.

  This sequence diagram shows typical processing of the packet communication apparatus 101 to which the network interface 105 is added.

  First, the network interface 105 is added to the packet communication apparatus 101. Then, the added NIF 105 requests a program from the node management processor 102 (1801).

  Then, the node management processor 102 requests the operator control terminal 103 to specify a program to be installed in the network interface 105 (1802).

  The operator control terminal 103 displays the contents of the received program designation request. The operator inputs designation of a program to be installed in the network interface 105 to the operator control terminal 103. Then, the operator control terminal 103 transmits a program designation response including the input content to the node management processor 102 (1803).

  The node management processor 102 receives a program designation response from the operator control terminal 103. Next, the node management processor 102 identifies the program designated by the operator from the received program designation response. Next, the node management processor 102 determines the function expansion module 108 that stores the identified program. Then, the node management processor 102 requests the identified function expansion module 108 for the identified program (1804).

  The function expansion module 108 requested for the program transmits the requested program to the node management processor 102 (1805).

  Then, the node management processor 102 receives a program from the function expansion module 108.

  Next, the node management processor 102 transmits the received program to the network interface 105. Further, the node management processor 102 requests the network interface 105 to install the transmitted program (1806).

  Then, the NIF 105 installs the received program.

  Then, the packet communication device 101 ends the NIF addition process.

  Next, the effect of the packet communication apparatus 101 of this embodiment will be described.

  Here, the packet communication apparatus 101 including the network interface 105 in which the notification program is installed will be described.

  The notification program installs or uninstalls the transfer program in the network interface 105 when an event that meets a predetermined condition occurs.

  An event that matches a predetermined condition includes an install event or an uninstall event. For example, the installation event is when the NIF 105 receives a packet having specific characteristics. The uninstall event is when a predetermined time has passed or when a predetermined time has come.

  The transfer program transfers the packet received by the network interface 105 to the function expansion module 108. Note that the transfer program may perform processing such as encapsulation, encryption, decryption, and / or copying before transfer to the function expansion module 108.

  FIG. 21A is a flowchart of event processing of the packet communication apparatus 101 according to the embodiment of this invention.

  First, when the NIF 105 detects an event that meets a predetermined condition, the packet communication apparatus 101 starts event processing (2001). Here, the NIF 105 may notify the operator control terminal 103 of the occurrence of the event.

  The network interface 105 determines whether the generated event is an installation event or an uninstallation event (2002).

  If it is an installation event, the network interface 105 transmits a program transmission request packet to the node management processor 102 (2003).

  The program transmission request packet requests the node management processor 102 to transmit the transfer program.

  FIG. 21B is a configuration diagram of a program transmission request packet according to the embodiment of the present invention.

  The program transmission request packet includes an internal header 111 and a payload 112.

  The internal header 111 includes a destination address 601 and a transmission source address 602.

  The destination address 601 is an internal address of a part in the apparatus that receives the packet. The transmission source address 602 is an internal address of a part in the device that transmits the packet.

  In the program transmission request packet, the destination address 601 is the internal address of the node management processor 102. A source address 602 is an internal address of the NIF 105.

  The payload 112 includes a node management processor processing code 701, a program designation code 761, and a program name 904.

  The NIF 105 creates the payload 112 of the program transmission request packet as follows.

  First, the network interface 105 selects from the node management processor processing code management table 700 a record whose processing content requested to the node management processor 102 matches the processing content 702 of the node management processor processing code management table 700. Next, the node management processor processing code 701 is extracted from the selected record. The extracted node management processor processing code 701 is stored in the payload 112 of the packet.

  The program transmission request packet requests the node management processor 102 to transmit the transfer program. Therefore, the function expansion module 108 stores the node management processor processing code 701 as “1” in the payload 112 of the packet.

  Next, the network interface 105 selects, from the program designation code management table 760, a record in which the program requesting installation matches the transmission program 762 in the program designation code management table 760. Next, the program designation code 761 is extracted from the selected record. The extracted program designation code 761 is stored in the payload 112 of the packet.

  In the program transmission request packet in this explanatory diagram, the transfer program is designated by the payload. Therefore, the network interface 105 stores the program designation code 761 as “2” in the payload 112 of the packet.

  The network interface 105 stores the program name 904 of the transfer program in the payload 112 of the packet.

  Returning now to FIG.

  The node management processor 102 receives the program transmission request packet from the network interface 105. Then, the node management processor 102 extracts the node management processor processing code from the payload 112 of the received program transmission request packet.

  Next, the node management processor 102 stores a record in which the extracted node management processor processing code matches the node management processor processing code 701 in the node management processor processing code management table 700 (FIG. 5A). The management processor processing code management table 700 is selected. Next, the processing content 702 is extracted from the selected record.

  Then, the node management processor 102 performs processing corresponding to the extracted processing content 702. Here, since the node management processor processing code is “1”, the program is transmitted to the network interface 105.

  Specifically, the node management processor 102 extracts a program designation code from the payload of the received program transmission request packet.

  Next, the node management processor 102 selects, from the program designation code management table 760, a record in which the extracted program designation code matches the program designation code 761 of the program designation code management table 760. Next, the transmission program 762 is extracted from the selected record.

  Next, the node management processor 102 specifies a program to be transmitted to the network interface 105 based on the extracted transmission program 762.

  Here, since the extracted program designation code is “2”, the node management processor 102 extracts the program name 904 from the received program transmission request packet. Then, the node management processor 102 transmits the transfer program having the extracted program name 904 to the network interface 105 (2004). The node management processor 102 transmits a transfer program using a program installation request packet (FIG. 19-1).

  Next, when transmitting the program installation request packet, the node management processor 102 updates the NIF-program management table 800 (2005). The NIF-program management table 800 update process is the same as step 1316 of the NIF addition process (FIG. 15). Therefore, detailed description is omitted.

  On the other hand, the network interface 105 receives a program installation request packet from the node management processor 102. Then, the NIF 105 extracts the NIF processing code from the payload 112 of the received program installation request packet.

  Next, the NIF 105 selects a record in which the extracted NIF processing code matches the NIF processing code 741 of the NIF processing code management table 740 from the NIF processing code management table 740. Next, the NIF 105 extracts the NIF processing content 742 from the selected record. Then, the NIF 105 performs processing corresponding to the extracted NIF processing content 742.

  Specifically, since the extracted NIF processing code 741 is “0”, the NIF 105 determines that the received packet is a program installation request packet. Therefore, the network interface 105 extracts the program 903 from the payload 112 of the received program installation request packet. Next, the network interface 105 installs the extracted program 903.

  Further, the network interface 105 updates the forwarding table 401 (2006). Note that the update process of the forwarding table 401 is the same as step 1318 of the NIF addition process (FIG. 15). Therefore, detailed description is omitted.

  Then, the packet communication device 101 ends the event process (2010).

  On the other hand, if it is an uninstall event in step 2002, the network interface 105 deletes the transfer program stored in the program memory 304. Further, the network interface 105 updates the forwarding table 401 (2007).

  Specifically, the network interface 105 selects, from the forwarding table 401, a record in which the program name of the deleted transfer program is stored in the processing content 403 of the forwarding table 401. Then, the selected record is deleted from the forwarding table 401.

  Next, the network interface 105 transmits a program deletion notification packet to the node management processor 102 (2008).

  FIG. 21C is a configuration diagram of a program deletion notification packet according to the embodiment of this invention.

  The program deletion notification packet notifies the node management processor 102 of program deletion.

  The program deletion notification packet includes an internal header 111 and a payload 112.

  The internal header 111 includes a destination address 601 and a transmission source address 602.

  The destination address 601 is an internal address of a part in the apparatus that receives the packet. The transmission source address 602 is an internal address of a part in the device that transmits the packet.

  In the program deletion notification packet, the destination address 601 is the internal address of the node management processor 102. A source address 602 is an internal address of the NIF 105.

  The payload 112 includes a node management processor processing code 701 and a program name 904.

  The NIF 105 creates the payload 112 of the program deletion notification packet as follows.

  First, the network interface 105 selects from the node management processor processing code management table 700 a record whose processing content requested to the node management processor 102 matches the processing content 702 of the node management processor processing code management table 700. Next, the node management processor processing code 701 is extracted from the selected record. Then, the extracted node management processor processing code 701 is stored in the payload 112 of the packet.

  The program deletion notification packet notifies the node management processor 102 of the program deletion, and requests an update of the NIF-program management table 800. Therefore, the network interface 105 stores the node management processor processing code 701 as “3” in the payload 112 of the packet.

  Next, the network interface 105 stores the program name 904 of the transfer program deleted from the program memory 304 in the payload of the packet.

  Returning now to FIG.

  The node management processor 102 receives the program deletion notification packet from the network interface 105. Then, the node management processor 102 extracts the node management processor processing code from the received program deletion notification packet.

  Next, the node management processor 102 stores a record in which the extracted node management processor processing code matches the node management processor processing code 701 in the node management processor processing code management table 700 (FIG. 5A). The management processor processing code management table 700 is selected. Next, the processing content 702 is extracted from the selected record.

  Then, the node management processor 102 performs processing corresponding to the extracted processing content 702. Here, since the extracted node management processor processing code is “3”, the node management processor 102 updates the NIF-program management table 800 (2009).

  Specifically, the node management processor 102 extracts the program name 904 from the payload 112 of the received packet. Further, the source address 602 is extracted from the internal header 111 of the received packet. Next, the node management processor 102 matches the extracted program name 904 with the program name 801 of the NIF-program management table 800, and further, the NIF number and NIF-program management table corresponding to the extracted transmission source address 602. A box that matches the NIF number 802 of 800 is selected from the NIF-program management table 800. Then, the circle stored in the selected box is deleted.

  Then, the packet communication device 101 ends the event process (2010).

  As described above, the network interface 105 in which the notification program is installed is installed only when the transfer program is necessary. Therefore, the program memory 304 can be used efficiently.

  In addition, when the notification program receives a packet that cannot be processed by the network interface 105, the notification program can also notify the operator control terminal 103 that there is a possibility of a setting error. In this case, upon receiving a notification that there is a possibility of a setting error, the operator control terminal 103 displays the content of the notification. Therefore, the operator can quickly find and eliminate setting errors in the packet communication apparatus 101.

The notification program can also install the transfer program when a certain time has elapsed or when a predetermined time has come. In this case, the transfer program can be installed in all the NIFs 105 at the same time. Therefore, the operator does not need to change the setting of each NIF 105, so the burden is reduced. Here, the features of the present invention will be described. A node management processor that controls the device; a network interface that transmits and receives packets to and from an external network; a function expansion module that performs predetermined processing on the packets; and a switch that transfers the packets within the device. In a packet communication system including a packet communication device, a terminal that transmits and receives packets to and from the packet communication device, and a network that connects the packet communication device and the terminal, the network interface includes a CPU and a memory. The memory stores a program executed by the CPU, the CPU processes the packet received from the external network by executing the program, and the function expansion module is stored in the memory. Remember the program And wherein the Rukoto. A node management processor that controls the device; a network interface that transmits and receives packets to and from an external network; a function expansion module that performs predetermined processing on the packets; and a switch that transfers the packets within the device; The network interface includes a CPU and a memory, the memory stores a program executed by the CPU, and the CPU executes the program by executing the program. , Processing a packet received from the external network, and the function expansion module stores a program stored in the memory. In the packet communication device according to the invention described in the claims, when the function expansion module is removed, the node management processor decreases the counter included in the program management information, and the counter When 0, the network interface storing the program corresponding to the counter is requested to delete the program. The program transfers a packet received from the external network to the function expansion module. The program requests the network interface to add or delete another program when a predetermined time has elapsed or a specific packet is received. The network interface added to the packet communication device requests a program to the node management processor, and the node management processor, when requested by the program, based on a preset condition, A program to be transmitted to the added network interface is specified, the specified program is acquired, and the acquired program is transmitted to the added network interface. In addition, an intra-node memory for storing information is provided, the intra-node memory stores program management information for managing programs, and the node management processor stores the identified program based on the program management information The specified location is specified, and the program is acquired from the specified location. The network interface is connected to a server outside the apparatus and a node outside the apparatus via the external network, and the node management processor stores the identified program in the node memory, the function expansion module, Obtained from a server outside the device or a node outside the device.

  The packet communication apparatus of the present invention can be applied to a node directly connected to a user.

It is a block diagram of the packet communication apparatus of an embodiment of the invention. It is a block diagram of the packet inside the packet communication apparatus of the embodiment of the present invention. 1 is a block diagram of a network to which a packet communication device according to an embodiment of the present invention is applied. It is a block diagram of NIF of an embodiment of the invention. It is a block diagram of a function expansion module of an embodiment of the invention. It is explanatory drawing of the internal address of the site | part which comprises the packet communication apparatus of embodiment of this invention. It is a block diagram of the forwarding table of NIF of an embodiment of this invention. It is a block diagram of the processor processing code management table for node management of the embodiment of the present invention. It is a block diagram of the program acquisition code management table of embodiment of this invention. It is a block diagram of the NIF designation code management table of the embodiment of the present invention. It is a block diagram of the packet designation | designated code management table of embodiment of this invention. It is a block diagram of the NIF-program management table of embodiment of this invention. It is a block diagram of the NIF process code management table of embodiment of this invention. It is a block diagram of the update code management table of the embodiment of the present invention. It is a block diagram of the program designation | designated code management table of embodiment of this invention. It is a block diagram of the module processing code management table of embodiment of this invention. It is a flowchart of the function expansion module addition process of the packet communication apparatus of embodiment of this invention. It is a block diagram of the internal header of embodiment of this invention. It is a block diagram of the payload of the installation request internal packet including the program of the embodiment of the present invention. It is a block diagram of the payload of the installation request internal packet including the location of the program according to the embodiment of the present invention. It is explanatory drawing of the display screen of the operator control terminal which received the NIF designation | designated request of embodiment of this invention. It is a block diagram of the program installation request packet of an embodiment of the invention. It is a block diagram of the forwarding table update request packet of embodiment of this invention. It is a block diagram of the module-program management table of embodiment of this invention. It is a flowchart of the program storage process of the node management processor of the embodiment of this invention. It is a sequence diagram of the function expansion module addition process of the packet communication apparatus according to the embodiment of the present invention. It is a flowchart of the packet transfer process of the conventional fixed transfer apparatus. It is a flowchart of the packet transfer process of the packet communication apparatus of embodiment of this invention. It is a flowchart of the function expansion module deletion process of the packet communication apparatus of embodiment of this invention. It is a block diagram of the forwarding table update request packet of embodiment of this invention. It is a flowchart of NIF addition processing of the packet communication device according to the embodiment of the present invention. It is a block diagram of the program transmission request packet of embodiment of this invention. It is a block diagram of the program request packet of the embodiment of the present invention. It is explanatory drawing of the display screen of the operator control terminal which received the program designation | designated request | requirement of embodiment of this invention. It is explanatory drawing of the display screen of the operator control terminal which received the program designation | designated request | requirement of embodiment of this invention. It is explanatory drawing of the display screen of the operator control terminal which received the program designation | designated request | requirement of embodiment of this invention. It is a block diagram of the program installation request packet of an embodiment of the invention. It is a block diagram of the program installation request packet of an embodiment of the invention. It is a sequence diagram of NIF addition processing of the packet communication apparatus according to the embodiment of the present invention. It is a flowchart of the event process of the packet communication apparatus of embodiment of this invention. It is a block diagram of the program transmission request packet of embodiment of this invention. It is a block diagram of the program deletion notification packet of the embodiment of the present invention.

Explanation of symbols

101 packet communication device 102 node management processor 103 operator control terminal 104 intra-node memory 105 NIF
106 Module I / F
107 I / F for control
108 Function Expansion Module 109 Internal Switch 110 External Network 301 NIF Management Processor 302 Memory in NIF 303 Packet Processing Processor 304 Program Memory 305 Internal I / F
306 External I / F
307 NIF internal switch 308 In-module processor 309 In-module memory 310 In-module I / F
401 Forwarding table

Claims (10)

A node management processor that controls the device; a network interface that transmits and receives packets to and from an external network; a function expansion module that performs predetermined processing on the packets; and a switch that transfers the packets within the device. In packet communication equipment,
  The network interface includes a CPU and a memory,
  The memory stores a program executed by the CPU,
  The CPU processes the packet received from the external network by executing the program,
  The function expansion module stores a program stored in the memory,
  The node management processor is:
  Receiving update information for updating the program stored in the memory from the function expansion module;
  The program is obtained from the location where the program is stored, identified based on the received update information,
  A packet communication apparatus, wherein the acquired program is transmitted to the network interface. The packet update apparatus according to claim 1, wherein the update information includes the program, information about a location of the program, and / or information representing characteristics of the program. In-node memory for storing information
  The packet communication device according to claim 2, wherein the intra-node memory stores the program and / or information regarding the location of the program included in the update information received by the node management processor. The network interface is connected to a server and a node outside the apparatus via the external network,
  3. The packet communication apparatus according to claim 2, wherein the information related to the location of the program is position information of a server or a node outside the apparatus storing the program. The node management processor is:
  Receiving the program from the function enhancement module;
  The packet communication apparatus according to claim 1, wherein the received program is transmitted to the network interface. The node management processor is:
  Receiving the program from the function enhancement module;
  In accordance with preset conditions, identify the network interface that is the transmission destination of the received program,
  The packet communication device according to claim 1, wherein the received program is transmitted to the specified network interface. In-node memory for storing information
  The in-node memory stores program management information for managing the program,
  The node management processor is:
  Receiving the program from the function enhancement module;
  Based on the program management information, identify the network interface that is the transmission destination of the received program,
  The packet communication device according to claim 1, wherein the received program is transmitted to the specified network interface. The program management information includes the version of the program, the correspondence between the network interface and the program, the correspondence between the function expansion module and the program, the remaining amount of the memory and / or the function expansion using the program. The packet communication device according to claim 7, further comprising a counter indicating the number of modules. The in-node memory stores information on the program and / or the location of the program,
  The node management processor relates to the location of the program stored in the memory, the program stored in the intra-node memory and / or the program stored in the intra-node memory based on the program management information. 9. The packet communication apparatus according to claim 8, wherein information is added or deleted. Node management processor
  When the network interface that is the transmission destination of the received program is identified, it is determined whether or not the program is already stored in the memory of the identified network interface by referring to the program management information.
  If already stored, increase the counter included in the program management information,
  9. The packet communication device according to claim 8, wherein the specified network interface transmits information for transferring a packet to the function enhancement module to the specified network interface.

Images